Threat Intelligence and Security Incidents

29 Dec 2023

Vulnerability Analysis | Apache OFBiz XML-RPC Deserialization Vulnerability (CVE-2023-49070)

Apache OFBiz is an e-commerce platform used to build multi-tier, distributed e-commerce application systems that are cross-platform, cross-database, cross-application-server, and suitable for medium to large-sized enterprises.

In December 2023, the official release of a new version patched the CVE-2023-49070 Apache OFBiz XML-RPC code execution vulnerability. The official team had removed the XML-RPC component from the main branch code in April, but the XML-RPC interface was not deprecated until the official release of 18.12.10. Attackers can exploit this vulnerability to obtain server privileges, and it is recommended to patch the vulnerability as soon as possible.

▌Vulnerability Details

As early as 2020, a deserialization vulnerability (CVE-2020-9496) appeared in Apache OFBiz, with the issue residing in the XML-RPC component. XML-RPC is also a project under the Apache Software Foundation, but it has basically not been updated since around 2010. XML-RPC has historically had multiple deserialization vulnerabilities (such as CVE-2016-5003, CVE-2019-17570) that were never patched.

Since Apache OFBiz used the XML-RPC component, it was affected. The official team hardened the relevant interfaces in subsequent versions to patch the vulnerability, but there was a bypass issue in the fix (CVE-2023-49070).

In CVE-2020-9496, the vulnerability was exploited by sending a packet containing an XML-formatted RPC request body to the /webtools/control/xmlrpc interface. This object contained a Base64-formatted payload:

In May 2020, after the vulnerability emerged, the official OFBiz team submitted the first patch in the commit https://github.com/apache/ofbiz-framework/commit/d955b03fdc226d600d81d19d273e773f84b5c000. The purpose of this patch was to add authentication to the XML-RPC interface:

This patch did not completely solve the problem, but it raised the barrier to exploitation, making it no longer a "Pre-Auth RCE" vulnerability.

In October 2021, a person named Jie Zhu reported this "Post-Auth RCE vulnerability" to the official team, which could be reproduced on the then-latest version 17.12.08. Since this vulnerability was not caused by OFBiz itself and XML-RPC was no longer maintained, it could not be fundamentally fixed.

The official team had to settle for the next best thing and used a filter to inspect requests in the commit https://github.com/apache/ofbiz-framework/commit/d6d863020c0fe89f949e5d2cd23d5ecc95d68c4c. An error would be thrown as long as this keyword was found in the Body:

This fix was quickly bypassed by Jie Zhu, as attackers could add a space and use this method to bypass the detection.

Consequently, the official team hardened it again in the commit https://github.com/apache/ofbiz-framework/commit/25293e4cf6f334a2ae33b3041acba45113dddce9, changing the detected keyword to, and moving the detection location to the framework/base/src/main/java/org/apache/ofbiz/base/util/CacheFilter.java file:

However, this method of throwing an error directly upon finding a string in the request body also had a problem: it would affect normal business requests that contain the string. Therefore, the official team added restrictions on request paths in https://github.com/apache/ofbiz-framework/commit/a5bdcc6f9ea59d5d614f64832d5b6acec8e81e97:

On the same day, the official team discovered that the interface path restriction was incorrect, so they made modifications in https://github.com/apache/ofbiz-framework/commit/19d29325910ee2c904b63a951437aa59f73f1d93:

The latest CVE-2023-49070 is a bypass of the aforementioned official hardening methods:

Bypassing the detection for this keyword
Bypassing the authentication for the XML-RPC interface

With these two bypasses, the latest vulnerability reverted back to a Pre-Auth RCE vulnerability.

▌Vulnerability Analysis

1. Bypassing Detection

First, the detection of this keyword needs to be bypassed. In Java, some middleware such as Tomcat can add Matrix Parameters in the request path using a semicolon (;): https://www.baeldung.com/cs/url-matrix-vs-query-parameters.

Therefore, we can also try to add a semicolon to the XML-RPC request path: /webtools/control/xmlrpc;/.

With the first restriction bypassed, the server returned the login page.

2. Bypassing Authentication Restrictions

In the method checking whether a user is logged in (org.apache.ofbiz.webapp.control.LoginWorker#checkLogin), there is a key judgment: "error".equals(login(request, response))

When the return value of the login() method is not equal to "error", the code will not enter the if statement, thereby bypassing return "error" and causing the login check method to return "success".

And in the login() method, there are several lines like this:

Since the parameters username, password, and token are retrieved from the session, they are null when not logged in. Therefore, if the value of the requirePasswordChange parameter is equal to Y, the login() method can return requirePasswordChange, otherwise it returns "error".

3. Conclusion

In summary, by simply modifying the request path to /webtools/control/xmlrpc;/?USERNAME=&PASSWORD=&requirePasswordChange=Y, both the permission check and keyword restriction can be bypassed.

▌Vulnerability Reproduction

1. Setting Up the Target Environment

Start the ofbiz:18.12.09 environment using Docker.

After waiting a few minutes, access https://localhost:8443/accounting to view the login page, indicating that the environment has started successfully.

2. Payload Generation

Use CommonsBeanutils1 from ysoserial to generate the payload:

3. Testing

Sending the packet using the reproduction method in CVE-2020-9496 shows that it is no longer possible to successfully enter the XMLRPC parsing process:

Modify the Path to /webtools/control/xmlrpc;/?USERNAME=&PASSWORD=&requirePasswordChange=Y to bypass the restriction:

Entering the container, it is evident that touch /tmp/success has been executed successfully:

▌SecurityValidation Verification Rules

On December 28, the attack simulation for this vulnerability was added to the SecurityValidation security measurement and verification platform. You can search for the keywords "Apache OfBiz" or "CVE-2023-49070" in the SecurityValidation platform to obtain relevant attack simulation verification actions. This allows you to verify whether your security defense system can effectively handle this vulnerability. The platform ensures your verification process is safe and harmless in an industry-unique manner.